[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] selinux: relabel tapfd in qemuPhysIfaceConnect



On 10/18/2012 09:55 PM, Eric Blake wrote:
On 10/18/2012 07:30 AM, Guannan Ren wrote:
Relabeling tapfd right after the tap device is created.
qemuPhysIfaceConnect is common function called both for static
netdevs and for hotplug netdevs.
---
  src/qemu/qemu_command.c | 9 +++++----
  1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 0c0c400..b24e9b1 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -170,6 +170,11 @@ qemuPhysIfaceConnect(virDomainDefPtr def,
          vmop, driver->stateDir,
          virDomainNetGetActualBandwidth(net));
      if (rc >= 0) {
+        if (virSecurityManagerSetTapFDLabel(driver->securityManager,
+                                            def, rc) < 0) {
+            VIR_FORCE_CLOSE(rc);
+            return -1;
+        }
          virDomainAuditNetDevice(def, net, res_ifname, true);
          VIR_FREE(net->ifname);
Looks like you leak net->ifname on error, not to mention that you are
skipping out on an audit point.  I think you need to fix up the logic
here to avoid leaks on failure to relabel the fd.

     In case of failure of relabel, I leaked char *res_ifname.
     Shall we need to do the audit on failure of tapfd relabelling?
     I don't think it is necessary to do it, is it?




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]